September 2012 - cypherpunks-legacy

Hack on Saudi Aramco hit 30,000 workstations, oil firm admits (John Leyden)
by Monty Solomon 03 Sep '12

03 Sep '12

First hacktivist-style assault to use malware? John Leyden, *The Register*, 29 August 2012 Analysis Saudi Aramco said that it had put its network back online on Saturday, 10 days after a malware attack floored 30,000 workstations at the oil giant. In a statement [1], Saudi Arabia's national oil firm said that it had "restored all its main internal network services" hit by a malware outbreak that struck on 15 August. The firm said its core business of oil production and exploration was not affected by the attack, which resulted in a decision to suspend Saudi Aramco's website for a period of a few days, presumably as a precaution. Corporate remote access services were also suspended as a result of the attack. Oil and production systems were run off "isolated network systems unaffected by the attack, which the firm has pledged to investigate. In the meantime, Saudi Aramco promised [2] to improve the security of its network to guard against fresh assaults. ... http://www.theregister.co.uk/2012/08/29/saudi_aramco_malware_attack_analysi… ------------------------------

1 0

Can YOU crack the Gauss uber-virus encryption?
by Monty Solomon 03 Sep '12

03 Sep '12

Appeal for help to break open hidden scrambled payload John Leyden, *The Register*, 14 August 2012 Antivirus experts have called on cryptographers and other clever bods for help after admitting they are no closer to figuring out the main purpose of the newly discovered Gauss supervirus. While it's known that the complex malware features many information-stealing capabilities, with a specific focus on capturing website passwords, online banking account credentials and system configuration data from infected machines, the content of the virus's encrypted payload is still a mystery. Kaspersky Lab had tracked Gauss for weeks before announcing its discovery last week. Antivirus experts at the security biz and elsewhere have been burning the midnight oil in the days since, and although progress has been made - for example in analysing its architecture [1], unique modules and communication methods - the payload encryption is unbroken. Researchers reckon the hidden binary blob, when decrypted and executed, looks for a program specifically named using an extended character set, such as Arabic or Hebrew. What that program might be remains unclear as long as the encryption remains unbroken. The general concuss among security experts is that Gauss - like Flame, Duqu and Stuxnet before it - is a nation-state sponsored cyber-espionage toolkit, quite possibly built from the same components as Flame. ... http://www.theregister.co.uk/2012/08/14/gauss_mystery_payload/ [One of my colleagues suggests that unraveling the hidden payload would require breaking some serious crypto, and that someone successfully doing so might not be in a position to want to claim success. But RISKS awaits any further news on this topic. PGN] ------------------------------

1 0

'first ever' Linux, Mac OS X-only password sniffing Trojan spotted (John Leyden)
by Monty Solomon 03 Sep '12

03 Sep '12

John Leyden, Windows? Who the hell uses that? *The Register*, 29 August 2012 Security researchers have discovered a potential dangerous Linux and Mac OS X cross-platform trojan. Once installed on a compromised machine, Wirenet-1 opens a backdoor to a remote command server, and logs key presses to capture passwords and sensitive information typed by victims. The program also grabs passwords submitted to Opera, Firefox, Chrome and Chromium web browsers, and credentials stored by applications including e-mail client Thunderbird, web suite SeaMonkey, and chat app Pidgin. The malware then attempts to upload the gathered data to a server hosted in the Netherlands. ... http://www.theregister.co.uk/2012/08/29/linux_mac_trojan/ ------------------------------

1 0

Firefox, Opera allow crooks to hide an entire phish site in a link (John Leyden)
by Monty Solomon 03 Sep '12

03 Sep '12

John Leyden, Watch out for the tinyurl that isn't, *The Register*, 3 Sep 2012 A shortcoming in browsers including Firefox and Opera allows crooks to easily hide an entire malicious web page in a clickable link - ideal for fooling victims into handing over passwords and other sensitive info. Usually, so-called "phishing attacks" rely on tricking marks into visiting websites designed by criminals to masquerade as banks and online stores, thus snaffling punters' credentials and bank account details when they try to use the bogus pages. However this requires finding somewhere to host the counterfeit sites, which are often quickly taken down by hosting companies and the authorities or blocked by filters. Instead, the malicious web pages can be stored in data URIs - uniform resource identifiers, not to be confused with URLs - which stuff the web code into a handy string that when clicked on, instructs the browser to unpack the payload and present it as a page. It negates the need to find somewhere to secrete your malicious page, and once shortened using a service such as TinyURL, the URI can be reduced to a small URL perfect for passing around social networks, online chats and e-mail. Crooks would still need to set up a server to receive data from victims, however. ... http://www.theregister.co.uk/2012/09/03/phishing_without_hosts_peril/ ------------------------------

1 0

Re: [drone-list] drone-list Digest, Vol 28, Issue 2
by Eugen Leitl 03 Sep '12

03 Sep '12

----- Forwarded message from Chris Csikszentmihalyi <robotic(a)gmail.com> -----

1 0

Thousands fall victim to utility payment scam (Scott Bauer)
by Monty Solomon 03 Sep '12

03 Sep '12

Scott Bauer, Thousands fall victim to utility payment scam, Associated Press, 12 Jul 2012 As much as President Barack Obama wants your vote, he's not actually offering to pay your monthly bills. But thousands of Americans have been persuaded otherwise, falling victim to a fast-moving scam that claims to be part of an Obama administration program to help pay utility bills in the midst of a scorching summer. The scheme spread quickly across the nation in recent weeks with help from victims who unwittingly shared it on social media sites before realizing they had been conned out of personal information such as Social Security, credit card and checking account numbers. ... http://www.boston.com/business/news/2012/07/12/thousands-fall-victim-utilit… ------------------------------

1 0

Smartphone apps track users even when shut down
by Richard M. Smith 03 Sep '12

03 Sep '12

http://www.boston.com/business/technology/2012/09/02/smartphone-apps-track-… Some smartphone apps collect and transmit sensitive information stored on a phone, including location, contacts, and Web browsing histories, even when the apps are not being used by the phone's owner, according to two researchers at the Massachusetts Institute of Technology. "It seems like people are no longer in control of their own privacy," said Frances Zhang, a master's degree student in computer science at MIT. Zhang and fellow researcher Fuming Shih, a computer science doctoral candidate, found that some popular apps for phones running Google Inc.'s Android operating system are continually collecting information without informing the phone's owner. The popular game Angry Birds uses the phone's GPS and Wi-Fi wireless networking features to track the owner's location, even when he's not playing the game, for example. Another game, Bowman, collects information from the phone's Internet browser, including what websites the owner has been visiting. And WhatsApp, a popular text-messaging program, scans the user's address book when it is seemingly idle. ------------------------------

1 0

[liberationtech] New policy directive for Internet Filtering in Pakistan
by Eugen Leitl 03 Sep '12

03 Sep '12

----- Forwarded message from Yosem Companys <companys(a)stanford.edu> -----

1 0

[tahoe-dev] TWN 37
by Eugen Leitl 03 Sep '12

03 Sep '12

----- Forwarded message from Patrick R McDonald <marlowe(a)antagonism.org> -----

1 0

Harvard Students in Cheating Scandal Say Collaboration Was Accepted
by Peter G. Neumann 03 Sep '12

03 Sep '12

[An early mention of this case stated: ``Harvard University is investigating what it calls an `unprecedented' case of cheating. College officials say around 125 students may have shared answers and plagiarized on a [Introduction To Congress] final exam.'' Source: Curt Nickisch, NPR 31 Aug.] The exam in question was an open-book take-home exam from a professor reportedly inclined to give mostly high grades based in part on factors such as the number of citations! Perhaps many of the 125 students were citing the same sources from the Internet? Is that collusion or collation collision? We await details. PGN] Richard Perez-Pena, *The New York Times*, 31 Aug 2012 Harvard students suspected in a major cheating scandal said that many of the accusations are based on innocent - or at least tolerated - collaboration among students, and with help from graduate-student teachers who sometimes gave them answers to test questions. Students said they were tripped up by a course whose tests were confusing, whose grading was inconsistent, and for which the professor and teaching assistants gave contradictory signals about what was expected. They face the possibility of a one-year suspension from Harvard or revocation of their diplomas if they have already graduated, and some said that they will sue the university if any serious punishment is meted out. In years past, the course, Introduction to Congress, had a reputation as one of the easiest at Harvard College. Some of the 279 students who took it in the spring semester said that the teacher, Matthew B. Platt, an assistant professor of government, told them at the outset that he gave high grades and that neither attending his lectures nor the discussion sessions with graduate teaching fellows was mandatory. ... http://www.nytimes.com/2012/09/01/education/students-of-harvard-cheating-sc… ------------------------------

1 0